CVE-2018-25176

Alive Parish 2.0.4 SQL Injection and Arbitrary File Upload

CVSS 8.8 HIGHEPSS 0.2%CWE-352

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 8.8EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

06 Mar 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Alive Parish 2.0.4 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the key parameter in the search endpoint. Attackers can also upload arbitrary files via the person photo upload functionality to the images/uploaded directory for remote code execution.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Affected products

Demo · Alive Parish

References

https://www.exploit-db.com/exploits/45840 https://www.vulncheck.com/advisories/alive-parish-sql-injection-and-arbitrary-file-upload